@openclaw/crabline 0.1.8 → 0.1.10

package/dist/src/servers/matrix.js

@@ -1,21 +1,123 @@
 import { createHash, randomBytes } from "node:crypto";
-import fs from "node:fs/promises";
+import { isIP } from "node:net";
 import path from "node:path";
-import { adminAuthError, hasAdminToken, jsonResponse, parseRequestBody, queryRecord, readInteger, readTrimmedString, startHttpJsonServer, } from "./http.js";
+import { adminAuthError, hasAdminToken, InvalidJsonBodyError, isJsonObject, jsonResponse, parseUnknownRequestBody, queryRecord, readInteger, readTrimmedString, RequestBodyTooLargeError, startHttpJsonServer, } from "./http.js";
+import { recordCommittedServerEvent, recordServerEvent, } from "./recorder.js";
+const MAX_MATRIX_FILTER_BYTES = 1024 * 1024;
+const MAX_MATRIX_FILTERS = 100;
+const MAX_MATRIX_IDENTIFIER_BYTES = 255;
+const MAX_MATRIX_TIMELINE_EVENTS = 1_000;
+const MAX_MATRIX_TRANSACTION_RESPONSES = 1_000;
+const MATRIX_TRANSACTION_RETENTION_MS = 10 * 60_000;
+const MAX_NODE_TIMER_DELAY_MS = 2_147_483_647;
+class InvalidMatrixPathEncodingError extends Error {
+    constructor() {
+        super("Matrix request path contains invalid percent encoding.");
+        this.name = "InvalidMatrixPathEncodingError";
+    }
+}
 function matrixId(prefix, value, serverName) {
     return `${prefix}${createHash("sha256").update(value).digest("hex").slice(0, 16)}:${serverName}`;
 }
-async function appendEvent(state, event) {
-    await fs.mkdir(path.dirname(state.recorderPath), { recursive: true });
-    await fs.appendFile(state.recorderPath, `${JSON.stringify(event)}\n`, "utf8");
+function isMatrixIpv4Address(value) {
+    const octets = value.split(".");
+    return (octets.length === 4 && octets.every((octet) => /^\d{1,3}$/u.test(octet) && Number(octet) <= 255));
+}
+function isMatrixServerName(value) {
+    const ipv6 = /^\[([^\]]+)\](?::(\d{1,5}))?$/u.exec(value);
+    if (ipv6) {
+        return isIP(ipv6[1]) === 6;
+    }
+    const hostAndPort = /^([^:]+?)(?::(\d{1,5}))?$/u.exec(value);
+    if (!hostAndPort) {
+        return false;
+    }
+    const hostname = hostAndPort[1];
+    if (isMatrixIpv4Address(hostname)) {
+        return true;
+    }
+    if (/^\d+\.\d+\.\d+\.\d+$/u.test(hostname)) {
+        return false;
+    }
+    return hostname.length <= 255 && /^[A-Za-z0-9.-]+$/u.test(hostname);
+}
+function hasLoneSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (next < 0xdc00 || next > 0xdfff) {
+                return true;
+            }
+            index += 1;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+function isMatrixScopedIdentifier(value, sigil) {
+    const separator = value.indexOf(":");
+    const localpart = value.slice(1, separator);
+    return (value.startsWith(sigil) &&
+        Buffer.byteLength(value, "utf8") <= MAX_MATRIX_IDENTIFIER_BYTES &&
+        separator >= (sigil === "@" ? 1 : 2) &&
+        !localpart.includes("\0") &&
+        !hasLoneSurrogate(localpart) &&
+        isMatrixServerName(value.slice(separator + 1)));
+}
+function isMatrixHashIdentifier(value, sigil, allowLegacyBase64) {
+    if (!value.startsWith(sigil) || Buffer.byteLength(value, "utf8") > MAX_MATRIX_IDENTIFIER_BYTES) {
+        return false;
+    }
+    const opaqueId = value.slice(1);
+    const encoding = allowLegacyBase64 && /^[A-Za-z0-9+/]{43}$/u.test(opaqueId)
+        ? "base64"
+        : /^[A-Za-z0-9_-]{43}$/u.test(opaqueId)
+            ? "base64url"
+            : undefined;
+    if (!encoding) {
+        return false;
+    }
+    const decoded = Buffer.from(opaqueId, encoding);
+    return decoded.length === 32 && decoded.toString(encoding).replace(/=+$/u, "") === opaqueId;
+}
+function isMatrixRoomId(value) {
+    return isMatrixScopedIdentifier(value, "!") || isMatrixHashIdentifier(value, "!", false);
+}
+function isMatrixEventId(value) {
+    return isMatrixScopedIdentifier(value, "$") || isMatrixHashIdentifier(value, "$", true);
+}
+function isMatrixUserId(value) {
+    return isMatrixScopedIdentifier(value, "@");
+}
+async function appendEvent(state, event, committed = false) {
+    const params = { event, onEvent: state.onEvent, recorderPath: state.recorderPath };
+    await (committed ? recordCommittedServerEvent(params) : recordServerEvent(params));
 }
 function authorized(request, token) {
-    const [scheme, value] = request.headers.authorization?.trim().split(/\s+/, 2) ?? [];
-    return scheme?.toLowerCase() === "bearer" && value === token;
+    const match = /^Bearer\s+(\S+)$/iu.exec(request.headers.authorization ?? "");
+    return match?.[1] === token;
 }
 function matrixError(errcode, error, status) {
     return jsonResponse({ errcode, error }, status);
 }
+function matrixResourceLimitError(error) {
+    return jsonResponse({
+        admin_contact: "mailto:admin@localhost",
+        errcode: "M_RESOURCE_LIMIT_EXCEEDED",
+        error,
+    }, 503);
+}
+function decodeMatrixPathSegment(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        throw new InvalidMatrixPathEncodingError();
+    }
+}
 function eventId(state) {
     return matrixId("$", `event-${state.nextEvent++}`, state.serverName);
 }
@@ -53,10 +155,15 @@ function createEvent(params) {
 function createRoom(params) {
     const room = {
         createdSequence: params.createdSequence,
+        ephemeral: [],
         id: params.id,
+        lastDroppedTimelineSequence: undefined,
         name: params.name,
         state: [],
+        stateBeforeTimeline: new Map(),
         timeline: [],
+        typingTimeouts: new Map(),
+        typingUsers: new Set(),
         users: new Map([[params.botUserId, { display_name: "OpenClaw QA" }]]),
     };
     room.state.push(createEvent({
@@ -85,35 +192,151 @@ function createRoom(params) {
         stateKey: "",
         type: "m.room.name",
     }));
+    for (const event of room.state) {
+        room.stateBeforeTimeline.set(matrixStateKey(event), event);
+    }
     return room;
 }
-function syncRoom(room, since) {
-    const events = room.timeline
-        .filter((entry) => since === undefined || entry.sequence > since)
-        .map((entry) => entry.event);
+function matrixStateKey(event) {
+    return JSON.stringify([event.type, event.state_key ?? ""]);
+}
+function appendTimelineEvent(room, entry) {
+    room.timeline.push(entry);
+    if (room.timeline.length > MAX_MATRIX_TIMELINE_EVENTS) {
+        const dropped = room.timeline.splice(0, room.timeline.length - MAX_MATRIX_TIMELINE_EVENTS);
+        room.lastDroppedTimelineSequence = dropped.at(-1)?.sequence;
+        for (const droppedEntry of dropped) {
+            if (droppedEntry.event.state_key !== undefined) {
+                room.stateBeforeTimeline.set(matrixStateKey(droppedEntry.event), droppedEntry.event);
+            }
+        }
+    }
+}
+function appendEphemeralEvent(room, entry) {
+    room.ephemeral.push(entry);
+    if (room.ephemeral.length > MAX_MATRIX_TIMELINE_EVENTS) {
+        room.ephemeral.splice(0, room.ephemeral.length - MAX_MATRIX_TIMELINE_EVENTS);
+    }
+}
+function publishTypingState(state, room) {
+    appendEphemeralEvent(room, {
+        event: { content: { user_ids: [...room.typingUsers] }, type: "m.typing" },
+        sequence: state.nextSequence++,
+    });
+    notifySyncWaiters(state);
+}
+function rememberTransaction(state, key, response) {
+    state.transactions.set(key, response);
+}
+function forgetExpiredTransactions(state) {
+    const now = Date.now();
+    for (const [key, response] of state.transactions) {
+        if (response.expiresAt > now) {
+            break;
+        }
+        state.transactions.delete(key);
+    }
+}
+function transactionResponse(state, key) {
+    forgetExpiredTransactions(state);
+    const response = state.transactions.get(key);
+    if (!response) {
+        return undefined;
+    }
+    state.transactions.delete(key);
+    response.expiresAt = Date.now() + MATRIX_TRANSACTION_RETENTION_MS;
+    state.transactions.set(key, response);
+    return response;
+}
+function readTimelineLimit(filter) {
+    const room = filter?.room;
+    const timeline = isJsonObject(room) ? room.timeline : undefined;
+    const limit = isJsonObject(timeline) ? readInteger(timeline.limit) : undefined;
+    return limit === undefined ? undefined : Math.max(0, limit);
+}
+function resolveSyncFilter(url, state) {
+    const value = url.searchParams.get("filter");
+    if (value === null) {
+        return undefined;
+    }
+    const stored = state.filters.get(value);
+    if (stored) {
+        return stored.body;
+    }
+    try {
+        const parsed = JSON.parse(value);
+        return isJsonObject(parsed) ? parsed : matrixError("M_INVALID_PARAM", "Invalid filter", 400);
+    }
+    catch {
+        return matrixError("M_INVALID_PARAM", "Unknown filter", 400);
+    }
+}
+function syncRoom(room, since, timelineLimit) {
+    const available = room.timeline.filter((entry) => since === undefined || entry.sequence > since);
+    const timeline = timelineLimit === undefined
+        ? available
+        : available.slice(Math.max(0, available.length - timelineLimit));
+    const firstSequence = timeline[0]?.sequence;
+    const historyWasTrimmed = room.lastDroppedTimelineSequence !== undefined &&
+        (since === undefined || since < room.lastDroppedTimelineSequence);
+    const limited = historyWasTrimmed || timeline.length < available.length;
+    const omittedTimeline = available.slice(0, available.length - timeline.length);
+    const omittedState = new Map();
+    if (since === undefined || room.createdSequence > since || historyWasTrimmed) {
+        for (const [key, event] of room.stateBeforeTimeline) {
+            omittedState.set(key, event);
+        }
+    }
+    for (const entry of omittedTimeline) {
+        if (entry.event.state_key !== undefined) {
+            omittedState.set(matrixStateKey(entry.event), entry.event);
+        }
+    }
     return {
         account_data: { events: [] },
-        ephemeral: { events: [] },
-        state: { events: since === undefined || room.createdSequence > since ? room.state : [] },
-        timeline: { events, limited: false, prev_batch: `s${since ?? 0}` },
+        ephemeral: {
+            events: room.ephemeral
+                .filter((entry) => since === undefined || entry.sequence > since)
+                .map((entry) => entry.event),
+        },
+        state: {
+            events: [...omittedState.values()].filter((event) => !timeline.some((entry) => entry.event.event_id === event.event_id)),
+        },
+        timeline: {
+            events: timeline.map((entry) => entry.event),
+            limited,
+            prev_batch: `s${firstSequence === undefined ? (since ?? 0) : firstSequence - 1}`,
+        },
         unread_notifications: { highlight_count: 0, notification_count: 0 },
     };
 }
 function parseSyncToken(value) {
-    if (!value) {
+    if (value === null) {
         return undefined;
     }
     const match = /^s(\d+)$/u.exec(value);
-    return match ? Number(match[1]) : undefined;
+    if (!match) {
+        return null;
+    }
+    const sequence = Number(match[1]);
+    return Number.isSafeInteger(sequence) ? sequence : null;
 }
 async function handleSync(url, state) {
     const since = parseSyncToken(url.searchParams.get("since"));
+    if (since === null || (since !== undefined && since > state.nextSequence - 1)) {
+        return matrixError("M_UNKNOWN_POS", "Unknown position", 400);
+    }
+    const filter = resolveSyncFilter(url, state);
+    if (filter instanceof Response) {
+        return filter;
+    }
+    const timelineLimit = readTimelineLimit(filter);
     const timeout = Math.min(readInteger(url.searchParams.get("timeout")) ?? 0, 1_000);
-    const hasNewEvents = [...state.rooms.values()].some((room) => room.timeline.some((entry) => since === undefined || entry.sequence > since));
+    const hasNewEvents = [...state.rooms.values()].some((room) => [...room.timeline, ...room.ephemeral].some((entry) => since === undefined || entry.sequence > since));
     if (since !== undefined && !hasNewEvents && timeout > 0) {
         await waitForSyncEvent(state, timeout);
     }
-    const join = Object.fromEntries([...state.rooms.values()].map((room) => [room.id, syncRoom(room, since)]));
+    const join = Object.fromEntries([...state.rooms.values()].map((room) => [room.id, syncRoom(room, since, timelineLimit)]));
     return jsonResponse({
         account_data: { events: [] },
         device_lists: { changed: [], left: [] },
@@ -125,7 +348,7 @@ async function handleSync(url, state) {
     });
 }
 function findRoom(state, encodedRoomId) {
-    return state.rooms.get(decodeURIComponent(encodedRoomId));
+    return state.rooms.get(decodeMatrixPathSegment(encodedRoomId));
 }
 async function handleAdminInbound(params) {
     const roomId = readTrimmedString(params.body.roomId);
@@ -134,6 +357,12 @@ async function handleAdminInbound(params) {
     if (!roomId || !sender || !text) {
         return jsonResponse({ error: "roomId, senderId, and text are required", ok: false }, 400);
     }
+    const threadId = readTrimmedString(params.body.threadId);
+    if (!isMatrixRoomId(roomId) ||
+        !isMatrixUserId(sender) ||
+        (threadId !== undefined && !isMatrixEventId(threadId))) {
+        return jsonResponse({ error: "Invalid Matrix identifier", ok: false }, 400);
+    }
     const direct = params.body.direct === true;
     const room = params.state.rooms.get(roomId) ??
         createRoom({
@@ -147,7 +376,8 @@ async function handleAdminInbound(params) {
         });
     params.state.rooms.set(roomId, room);
     const senderName = readTrimmedString(params.body.senderName);
-    if (!room.users.has(sender)) {
+    const existingProfile = room.users.get(sender);
+    if (existingProfile === undefined) {
         room.users.set(sender, senderName ? { display_name: senderName } : {});
         const membership = createEvent({
             content: {
@@ -161,13 +391,31 @@ async function handleAdminInbound(params) {
             type: "m.room.member",
         });
         room.state.push(membership);
-        room.timeline.push({ event: membership, sequence: params.state.nextSequence++ });
+        appendTimelineEvent(room, { event: membership, sequence: params.state.nextSequence++ });
     }
-    else if (senderName) {
-        room.users.set(sender, { display_name: senderName });
+    else if (senderName && existingProfile.display_name !== senderName) {
+        room.users.set(sender, { ...existingProfile, display_name: senderName });
+        const membership = createEvent({
+            content: { membership: "join", displayname: senderName },
+            roomId,
+            sender,
+            state: params.state,
+            stateKey: sender,
+            type: "m.room.member",
+        });
+        const stateIndex = room.state.findIndex((event) => event.type === "m.room.member" && event.state_key === sender);
+        if (stateIndex >= 0) {
+            room.state[stateIndex] = membership;
+        }
+        else {
+            room.state.push(membership);
+        }
+        appendTimelineEvent(room, {
+            event: membership,
+            sequence: params.state.nextSequence++,
+        });
     }
     const content = { body: text, msgtype: "m.text" };
-    const threadId = readTrimmedString(params.body.threadId);
     if (threadId) {
         content["m.relates_to"] = {
             event_id: threadId,
@@ -183,7 +431,7 @@ async function handleAdminInbound(params) {
         state: params.state,
         type: "m.room.message",
     });
-    room.timeline.push({ event, sequence: params.state.nextSequence++ });
+    appendTimelineEvent(room, { event, sequence: params.state.nextSequence++ });
     notifySyncWaiters(params.state);
     return jsonResponse({ event, ok: true });
 }
@@ -204,7 +452,7 @@ async function handleMatrixApi(params) {
     }
     let match = /^\/profile\/([^/]+)$/u.exec(relativePath);
     if (params.method === "GET" && match) {
-        const userId = decodeURIComponent(match[1]);
+        const userId = decodeMatrixPathSegment(match[1]);
         const member = [...params.state.rooms.values()]
             .map((room) => room.users.get(userId))
             .find((profile) => profile !== undefined);
@@ -224,18 +472,28 @@ async function handleMatrixApi(params) {
     }
     match = /^\/user\/([^/]+)\/filter$/u.exec(relativePath);
     if (params.method === "POST" && match) {
-        const userId = decodeURIComponent(match[1]);
+        const userId = decodeMatrixPathSegment(match[1]);
         if (userId !== params.state.botUserId) {
             return matrixError("M_FORBIDDEN", "Cannot create a filter for another user", 403);
         }
+        const bytes = Buffer.byteLength(JSON.stringify(params.body), "utf8");
+        if (params.state.filters.size >= MAX_MATRIX_FILTERS ||
+            params.state.filterBytes + bytes > MAX_MATRIX_FILTER_BYTES) {
+            return matrixResourceLimitError("Too many stored filters");
+        }
         const filterId = String(params.state.nextFilter++);
-        params.state.filters.set(filterId, params.body);
+        params.state.filters.set(filterId, { body: params.body, bytes });
+        params.state.filterBytes += bytes;
         return jsonResponse({ filter_id: filterId });
     }
     match = /^\/user\/([^/]+)\/filter\/([^/]+)$/u.exec(relativePath);
     if (params.method === "GET" && match) {
-        const filter = params.state.filters.get(decodeURIComponent(match[2]));
-        return filter ? jsonResponse(filter) : matrixError("M_NOT_FOUND", "Unknown filter", 404);
+        const userId = decodeMatrixPathSegment(match[1]);
+        if (userId !== params.state.botUserId) {
+            return matrixError("M_FORBIDDEN", "Cannot get filters for another user", 403);
+        }
+        const filter = params.state.filters.get(decodeMatrixPathSegment(match[2]));
+        return filter ? jsonResponse(filter.body) : matrixError("M_NOT_FOUND", "Unknown filter", 404);
     }
     match = /^\/rooms\/([^/]+)\/joined_members$/u.exec(relativePath);
     if (params.method === "GET" && match) {
@@ -250,8 +508,8 @@ async function handleMatrixApi(params) {
         if (!room) {
             return matrixError("M_NOT_FOUND", "Unknown room", 404);
         }
-        const eventType = decodeURIComponent(match[2]);
-        const stateKey = decodeURIComponent(match[3] ?? "");
+        const eventType = decodeMatrixPathSegment(match[2]);
+        const stateKey = decodeMatrixPathSegment(match[3] ?? "");
         if (eventType === "m.room.name" && stateKey === "") {
             return jsonResponse({ name: room.name });
         }
@@ -270,28 +528,125 @@ async function handleMatrixApi(params) {
     }
     match = /^\/rooms\/([^/]+)\/send\/([^/]+)\/([^/]+)$/u.exec(relativePath);
     if (params.method === "PUT" && match) {
-        const room = findRoom(params.state, match[1]);
+        const roomId = decodeMatrixPathSegment(match[1]);
+        const eventType = decodeMatrixPathSegment(match[2]);
+        const transactionId = decodeMatrixPathSegment(match[3]);
+        const transactionKey = JSON.stringify([
+            params.state.botUserId,
+            roomId,
+            eventType,
+            transactionId,
+        ]);
+        const existingResponse = transactionResponse(params.state, transactionKey);
+        if (existingResponse) {
+            params.recorderEvent.accepted =
+                existingResponse.status >= 200 && existingResponse.status < 300;
+            return jsonResponse(existingResponse.body, existingResponse.status);
+        }
+        if (params.state.transactions.size >= MAX_MATRIX_TRANSACTION_RESPONSES) {
+            params.recorderEvent.accepted = false;
+            return matrixResourceLimitError("Too many retained transaction responses");
+        }
+        const room = params.state.rooms.get(roomId);
         if (!room) {
-            return matrixError("M_NOT_FOUND", "Unknown room", 404);
+            params.recorderEvent.accepted = false;
+            const body = { errcode: "M_NOT_FOUND", error: "Unknown room" };
+            rememberTransaction(params.state, transactionKey, {
+                body,
+                expiresAt: Date.now() + MATRIX_TRANSACTION_RETENTION_MS,
+                status: 404,
+            });
+            return jsonResponse(body, 404);
         }
         const event = createEvent({
             content: params.body,
             roomId: room.id,
             sender: params.state.botUserId,
             state: params.state,
-            transactionId: decodeURIComponent(match[3]),
-            type: decodeURIComponent(match[2]),
+            transactionId,
+            type: eventType,
+        });
+        appendTimelineEvent(room, { event, sequence: params.state.nextSequence++ });
+        const body = { event_id: event.event_id };
+        rememberTransaction(params.state, transactionKey, {
+            body,
+            expiresAt: Date.now() + MATRIX_TRANSACTION_RETENTION_MS,
+            status: 200,
         });
-        room.timeline.push({ event, sequence: params.state.nextSequence++ });
         notifySyncWaiters(params.state);
-        return jsonResponse({ event_id: event.event_id });
+        params.recorderEvent.accepted = true;
+        return jsonResponse(body);
     }
     match = /^\/rooms\/([^/]+)\/typing\/([^/]+)$/u.exec(relativePath);
     if (params.method === "PUT" && match) {
+        const room = findRoom(params.state, match[1]);
+        if (!room) {
+            return matrixError("M_NOT_FOUND", "Unknown room", 404);
+        }
+        const userId = decodeMatrixPathSegment(match[2]);
+        if (userId !== params.state.botUserId) {
+            return matrixError("M_FORBIDDEN", "Cannot set typing state for another user", 403);
+        }
+        if (typeof params.body.typing !== "boolean") {
+            return matrixError("M_BAD_JSON", "typing must be a boolean", 400);
+        }
+        const timeout = params.body.typing &&
+            typeof params.body.timeout === "number" &&
+            Number.isSafeInteger(params.body.timeout)
+            ? params.body.timeout
+            : undefined;
+        if (params.body.typing &&
+            (timeout === undefined || timeout < 1 || timeout > MAX_NODE_TIMER_DELAY_MS)) {
+            return matrixError("M_BAD_JSON", `timeout must be a positive integer no greater than ${MAX_NODE_TIMER_DELAY_MS}`, 400);
+        }
+        const existingTimeout = room.typingTimeouts.get(userId);
+        if (existingTimeout) {
+            clearTimeout(existingTimeout);
+            room.typingTimeouts.delete(userId);
+        }
+        if (params.body.typing) {
+            room.typingUsers.add(userId);
+            const timer = setTimeout(() => {
+                room.typingTimeouts.delete(userId);
+                if (room.typingUsers.delete(userId)) {
+                    publishTypingState(params.state, room);
+                }
+            }, timeout);
+            timer.unref();
+            room.typingTimeouts.set(userId, timer);
+        }
+        else {
+            room.typingUsers.delete(userId);
+        }
+        publishTypingState(params.state, room);
         return jsonResponse({});
     }
     match = /^\/rooms\/([^/]+)\/receipt\/m\.read\/([^/]+)$/u.exec(relativePath);
     if (params.method === "POST" && match) {
+        const room = findRoom(params.state, match[1]);
+        if (!room) {
+            return matrixError("M_NOT_FOUND", "Unknown room", 404);
+        }
+        const receiptEventId = decodeMatrixPathSegment(match[2]);
+        appendEphemeralEvent(room, {
+            event: {
+                content: {
+                    [receiptEventId]: {
+                        "m.read": {
+                            [params.state.botUserId]: {
+                                ts: Date.now(),
+                                ...(readTrimmedString(params.body.thread_id)
+                                    ? { thread_id: readTrimmedString(params.body.thread_id) }
+                                    : {}),
+                            },
+                        },
+                    },
+                },
+                type: "m.receipt",
+            },
+            sequence: params.state.nextSequence++,
+        });
+        notifySyncWaiters(params.state);
         return jsonResponse({});
     }
     return matrixError("M_UNRECOGNIZED", "Unrecognized request", 404);
@@ -304,14 +659,17 @@ export async function startMatrixServer(params = {}) {
         adminToken: params.adminToken ?? randomBytes(24).toString("hex"),
         botUserId: params.botUserId ?? `@openclaw:${serverName}`,
         deviceId: params.deviceId ?? "CRABLINE",
+        filterBytes: 0,
         filters: new Map(),
         nextEvent: 1,
         nextFilter: 1,
         nextSequence: 1,
+        onEvent: params.onEvent,
         recorderPath: params.recorderPath ?? path.resolve("artifacts/crabline/matrix.jsonl"),
         rooms: new Map(),
         serverName,
         syncWaiters: new Set(),
+        transactions: new Map(),
     };
     const roomId = params.roomId ?? matrixId("!", "default-room", serverName);
     state.rooms.set(roomId, createRoom({
@@ -323,45 +681,101 @@ export async function startMatrixServer(params = {}) {
         state,
     }));
     const server = await startHttpJsonServer({
+        handleError: (error) => {
+            if (error instanceof InvalidJsonBodyError) {
+                return matrixError("M_NOT_JSON", "Request body is not valid JSON", 400);
+            }
+            if (error instanceof RequestBodyTooLargeError) {
+                return matrixError("M_TOO_LARGE", "Request body is too large", 413);
+            }
+            if (error instanceof InvalidMatrixPathEncodingError) {
+                return matrixError("M_INVALID_PARAM", "Invalid request path encoding", 400);
+            }
+            return matrixError("M_UNKNOWN", "Internal server error", 500);
+        },
         host,
         port: params.port ?? 0,
         serverName: "Matrix",
         async handle(request) {
             const url = new URL(request.url ?? "/", "http://localhost");
             const method = request.method ?? "GET";
-            const body = ["POST", "PUT"].includes(method) ? await parseRequestBody(request) : {};
             const type = url.pathname === "/crabline/matrix/inbound" ? "admin" : "api";
-            await appendEvent(state, {
-                at: new Date().toISOString(),
-                ...(Object.keys(body).length > 0 ? { body } : {}),
-                method,
-                path: url.pathname,
-                query: queryRecord(url),
-                type,
-            });
             if (type === "admin") {
                 if (method !== "POST") {
                     return jsonResponse({ error: "Method not allowed", ok: false }, 405);
                 }
-                return hasAdminToken(request, state.adminToken)
-                    ? await handleAdminInbound({ body, state })
-                    : adminAuthError();
+                if (!hasAdminToken(request, state.adminToken)) {
+                    request.resume();
+                    return adminAuthError();
+                }
+                const body = await parseUnknownRequestBody(request);
+                if (!isJsonObject(body)) {
+                    return jsonResponse({ error: "Request body must be a JSON object", ok: false }, 400);
+                }
+                await appendEvent(state, {
+                    at: new Date().toISOString(),
+                    ...(Object.keys(body).length > 0 ? { body } : {}),
+                    method,
+                    path: url.pathname,
+                    query: queryRecord(url),
+                    type,
+                });
+                return await handleAdminInbound({ body, state });
             }
             if (url.pathname === "/_matrix/client/versions" && method === "GET") {
+                await appendEvent(state, {
+                    at: new Date().toISOString(),
+                    method,
+                    path: url.pathname,
+                    query: queryRecord(url),
+                    type,
+                });
                 return jsonResponse({ unstable_features: {}, versions: ["v1.11"] });
             }
             if (!url.pathname.startsWith("/_matrix/client/")) {
                 return matrixError("M_UNRECOGNIZED", "Unrecognized request", 404);
             }
             if (!authorized(request, state.accessToken)) {
+                request.resume();
                 return matrixError("M_UNKNOWN_TOKEN", "Invalid access token", 401);
             }
-            return await handleMatrixApi({ body, method, path: url.pathname, state, url });
+            const parsedBody = ["POST", "PUT"].includes(method)
+                ? await parseUnknownRequestBody(request)
+                : {};
+            if (!isJsonObject(parsedBody)) {
+                return matrixError("M_BAD_JSON", "Request body must be a JSON object", 400);
+            }
+            const event = {
+                at: new Date().toISOString(),
+                ...(Object.keys(parsedBody).length > 0 ? { body: parsedBody } : {}),
+                method,
+                path: url.pathname,
+                query: queryRecord(url),
+                type,
+            };
+            const response = await handleMatrixApi({
+                body: parsedBody,
+                method,
+                path: url.pathname,
+                recorderEvent: event,
+                state,
+                url,
+            });
+            await appendEvent(state, event, response.ok && ["DELETE", "POST", "PUT"].includes(method));
+            return response;
         },
     });
     const clientApiRoot = `${server.baseUrl}/_matrix/client/v3`;
     return {
-        close: server.close,
+        async close() {
+            for (const room of state.rooms.values()) {
+                for (const timer of room.typingTimeouts.values()) {
+                    clearTimeout(timer);
+                }
+                room.typingTimeouts.clear();
+            }
+            await server.close();
+        },
         manifest: {
             accessToken: state.accessToken,
             adminToken: state.adminToken,